CVE-2025-23013: pam-u2f: problematic PAM_IGNOturn values in pam_sm_authenticate() (CVE-2025-23013)
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23013?
CVE-2025-23013 has a moderate severity rating due to the potential for local privilege escalation.
How do I fix CVE-2025-23013?
To mitigate CVE-2025-23013, upgrade Yubico pam-u2f to version 1.3.1 or later.
What systems are affected by CVE-2025-23013?
CVE-2025-23013 affects Yubico pam-u2f versions prior to 1.3.1 on macOS and Linux.
Can CVE-2025-23013 be exploited remotely?
No, CVE-2025-23013 requires local access to exploit the privilege escalation.
What impact does CVE-2025-23013 have on my system?
CVE-2025-23013 could allow an attacker with local access to gain elevated privileges on the system.